Ahmadi/com2care_website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): trust deployed CSRF origin

Browse Source 
The live hostname is comp2care.com while the previous configuration only trusted com2care.com. Always include both production domain variants so stale environment overrides cannot block admin login.
This commit is contained in:
mohamad
2026-09-24 09:21:33 +03:30
parent 588d95f889
commit 4bcb5f196d
4 changed files with 29 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-compose.yml
+2 -2
View File
@@ -22,8 +22,8 @@ services:
environment:
DJANGO_SETTINGS_MODULE: ${DJANGO_SETTINGS_MODULE:-config.settings.production}
DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:-django-insecure-local-com2care-change-in-production}
ALLOWED_HOSTS: ${ALLOWED_HOSTS:-localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com}
CSRF_TRUSTED_ORIGINS: ${CSRF_TRUSTED_ORIGINS:-http://localhost:8000,https://com2care.com,https://www.com2care.com}
ALLOWED_HOSTS: ${ALLOWED_HOSTS:-localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com,comp2care.com,www.comp2care.com}
CSRF_TRUSTED_ORIGINS: ${CSRF_TRUSTED_ORIGINS:-http://localhost:8000,https://com2care.com,https://www.com2care.com,https://comp2care.com,https://www.comp2care.com}
SECURE_SSL_REDIRECT: ${SECURE_SSL_REDIRECT:-False}
POSTGRES_DB: ${POSTGRES_DB:-com2care}
POSTGRES_USER: ${POSTGRES_USER:-com2care_user}